This SourceMod addon (for CS:S, DOD:S and TF2) provides general purpose flood and exploit protection. Chat- and radio-flooders will get the message &quot;No spam!&quot; and be blocked for a certain amount of time. Players flooding the server using a flooding-script such as with ma_timeleft, will be kicked instantly, and temporarily banned on the second flooding attempt. The plugin integrates very smoothly with the game, as it also takes care of chat and radio deadtimes that are imposed by the engine itself. The plugin fixes practically all important server crashing exploits and bugs for servers not using sv_cheats (no server should enable cheats anyway).

The plugin exposes the native &quot;IsClientFlooding&quot; which can be used by other plugins to ignore chat commands while a player is flooding.

More detailed features:

Blocks a lot of dangerous console commands, some of which are capable of crashing the server in certain situations

Prevents server crashes caused by people sending many incorrect rcon passwords. For best protection it is recommended to block the servers TCP port (default 27015) via firewall.

Players having control characters such as line breaks or CS:S color codes in their name will not be allowed to connect (also blocked are &names&, names containing only spaces, or zero-length names)

Player names within the joined-the-game, change-name and disconnect messages are cleaned from control characters so they do not mess up the chat

Chat messages containing control characters will be blocked

Players using voice_loopback (makes them hear their own voice stream, used by HLDJ and other playback tools) will be muted automatically. This cuts down about 90% of the music-spam on a server

Disconnect reasons are filtered for control characters and truncated to a reasonable length. This fixes exploits where using malformed disconnect messages, a client was able to crash or disconnect other clients. As a side effect, this also fixes the Steam disconnect messages (&quot;No Steam Logon&quot;, &quot;STEAM UserID is already in use on this server&quot;, ...) that had line breaks in them and thus messed up the chat and server logs

Connect spammers will be IP-banned for a short time, so any attempt will only cause max. 3 joined-the-game lines on the server (when using the default convar values). IP-ban removal is enforced by the plugin, fixing the bug where some temporary bans would not get removed by the server itself

Changes in v1.1: (2009/04)

Improved spam-detection algorithm

Radio messages are now included in the calculation and are blocked as well

I use the default settings, although I think I'm going to increase the hard_num parameter, some people still get kicked for buying binds and stuff at 25...
Note: You shouldn't modify the version cvar (its 1.4 in your first post), the plugin handles this.

Alright, here's the new version, hard_num now defaults to 200, min is 10 and max is 750, that should suffice. The buy scripts I checked out have around 10 commands per button press, so even when pressing their button in quick succession it wont kick you too soon, you'd have to manage 10 times a second.
The floodscript I found on the net sends 150 commands per buttonpress, you now have to press twice to get kicked with that. To get the clients to overflow or stuff like that, you usually hit that button very often, so this shouldn't be an issue.

Alright, here's the new version, hard_num now defaults to 200, min is 10 and max is 750, that should suffice. The buy scripts I checked out have around 10 commands per button press, so even when pressing their button in quick succession it wont kick you too soon, you'd have to manage 10 times a second.
The floodscript I found on the net sends 150 commands per buttonpress, you now have to press twice to get kicked with that. To get the clients to overflow or stuff like that, you usually hit that button very often, so this shouldn't be an issue.